Extracted

Extracted

Extracted

• • Target

    e4d8c967b7d18bf50068527cec39ec2f3788b1ca0dc5720f7d3f3cf3836cbb15.exe

  • Size

    785KB

  • MD5

    0199ebd5dba25ce44ecca85711feb797

  • SHA1

    2ae1eb74dd407c73cb4f21a76262650ff4fd1ced

  • SHA256

    e4d8c967b7d18bf50068527cec39ec2f3788b1ca0dc5720f7d3f3cf3836cbb15

  • SHA512

    81827e535fac8633cc6c30bb5ecbebe51c8bd83c85f943281825ff6fcf8cb658bf59fb6f42d8e40503cdf0f0cc56a9597dfb09dfbfbd4aa9a6d85054073fb454

  • SSDEEP

    12288:UMrCy900tgoaR8DJpP6qzW6DYtK5oMWBK1cKp+OAGWnpXr0iw5ILZc:2yKoHDvCBCpcnGopXgiw5ILi

  Score

  10^/10

  amadeyredlinemaxirovnodiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2